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FIELD OF THE INVENTION 
The present invention relates to network security in general and particularly to 
methods and apparatus for preventing unauthorized copying of files transmitted via computer 



networks. 



BACKGROUND OF THE INVENTION 
Preventing unauthorized copying of files transmitted via computer networks is 
difficult given the current state of the art. Typically, a computer terminal or "client" connected to a 
network, such as the Internet, sends a request to a "server" also connected to the network. Such 
requests are often for files known as "web pages," documents constructed using Hypertext Markup 
Language or HTML, and their associated files which may contain images, sound, or other data. The 
files are then sent by the server to the client where the files may be output, often using software 
known as a "browser" which displays web pages, images, and plays sound files. Requested files are 
typically received at the client in a standard format such as GIF, JPEG, or MIDI and automatically 
stored at the client, and may be easily copied, pasted, and altered, allowing for unrestricted future 
reuse, often in violation of copyright laws. 

SUMMARY OF THE INVENTION 

The present invention seeks to provide improved methods and apparatus for 
preventing unauthorized copying of files transmitted via computer networks that overcome the 
known disadvantages of the prior art as discussed above.. 

There is thus provided in accordance with a preferred embodiment of the present 
invention a method for preventing unauthorized copying of files sent from a first computer to a 
second computer. The method comprises the following steps: 
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(a) sending a request for a file from the second computer to the first computer; 

(b) determining at the first computer, in response to the request, whether the file 
is to be protected and, if so, protecting the file; 

(c) sending the protected file to the second computer; 

(d) disabling file copying capabilities at the second computer; 

(e) unprotecting the file at the second computer; and 

(f) outputting the file at the second computer. 



In a preferred embodiment any of the sending steps comprises sending via a 



network. 



Preferably the first computer is a server and the second computer is a client. 

Preferably the determining step (b) comprises protecting the file by encrypting the 
file using an encryption key and the unprotecting step (e) comprises decrypting the encrypted file 
using the encryption key. 

In many cases the second computer may be configured with a MICROSOFT 
WINDOWS operating system. Thus the disabling step (d) comprises trapping any of print screen, 
bitblt, stretchblt, and getpixel function calls and, in response to the trapping, replacing contents of a 
clipboard associated with the operating system with substitute contents. 



Alternatively or additionally in such a case disabling step (d) comprises trapping any 
of print screen, bitblt, stretchblt, and getpixel function calls and, in response to the trapping, 
marring contents of a clipboard associated with the operating system. 
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Preferably the outputting step (f) comprises displaying the file on a computer 

monitor. 

If appropriate, the outputting step (f) may comprise outputting the file as sound. 
The method may comprise the further step of 

(g) maintaining at the first computer a list of files to be protected, the 
determining step (b) comprising determining whether the file requested in step (a) is in the list of 
files. 

1 In a further embodiment the method comprises the following additional steps prior 

to the sending a request step (a): 

(h) sending a request for an HTML file from the second computer to the 

first computer; 

(i) determining at the first computer, in response to the request, whether 
the HTML file comprises an instruction to retrieve a file to be protected; 

0) modifying the HTML file by replacing the instruction with an 
instruction to invoke a protection module for use in retrieving the file to be protected; and 
(k) sending the modified HTML file to the second computer. 

Preferably, the stage of modifying the HTML file step (h) comprises replacing the 
name of the file to be protected with a substitute file name. 



Preferably, modifying the HTML file step (h) comprises deriving the substitute file 
name from the name of the file to be protected using a predetermined file name derivation 
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algorithm. 



^ In one embodiment the procedure is modified as follows, 

(I) maintaining at the first computer a mapping of names of files to be protected 
to corresponding substitute file names, and wherein the determining step (b) comprises determining 
whether the name of the file requested m step (a) is a substitute file name in the mapping and, if so, 
protecting the file to be protected corresponding to the substitute file name. 

An embodiment further comprises configuring the second computer with the 
protection module. 

Preferably the protection module periodically checks a third computer for an 
updated component of the protection module and, if found, downloads the updated component. 

In an embodiment determining step (b) comprises protecting the file by encrypting 
the file using an encryption key together uath a predetermined hash value incorporated therein, and 
further comprising configuring the second computer with a protection module operative to hash a 
software component of the protection module, thereby deriving the predetermined hash value, and 
incorporate the hash value into the encyption key, and wherein the unprotectmg step (e) comprises 
decrypting the encrypted file using the encryption key together with the derived hash value. 

A particularly preferred embodiment further comprises configuring the second 
computer with a blacklist of known software applications, and wherein the outputting step (f) 
comprises outputting only if none of the blacklisted applications are currently running on the 
second computer. 
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According to a second aspect of the present invention there is provided a method for 
serving a CGI request by proxy, the method comprising: 

sending a CGI request from a client to a server; 

forwarding the CGI request from the server to a filter; 

appending at the filter an identifier to the CGI request; 

sending the CGI request with identifier from the filter to the server; 

forwarding the CGI request with identifier from the server to a filter; 

removing at the filter the identifier from the CGI request; 
sending the CGI request from the filter to a CGI program; 
processing the CGI request at the CGI program; 
receiving at the server results from the CGI program; 
sending the results from the server to the filter; 
processing the results at the filter; and 
sending the processed results to the client. 



According to a third aspect of the present invention there is provided a method for 
serving an aliased HTTP request, the method comprising: 

sending a request for a file from a client to a first server; 

issuing a substitute HTTP request corresponding to the requested file to a second 

server; 

receiving at the first server results of the substitute HTTP request; 
processing the results at the first server; and 
sending the processed results to the client. 
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It is noted that throughout the specification and claims the term "user" as it is used 
with respect to the use of a computer may refer to a human or surrogate therefor in combination 
with the computer with which the human or surrogate interacts. Thus, unless otherwise specified, a 
reference to a user may connote a reference to the user's computer, and a reference to a user's 
computer may connote a reference to the user. 

It is further noted that throughout the specification and claims the term "file- 
includes any collection of data that may be stored in a computer memory, on magnetic storage 
media, or any storage means for use with and/or by a computer. 

BRIEF DESCRIPTION OF THE DRAWINGS 

The present invention will be understood and appreciated more fully from the 
following detailed description, taken in conjunction with the drawings in which: 

Fig. 1 is a simplified block diagram of a system for preventing unauthorized copying 
of files, the system constructed and operative in accordance with a preferred embodiment of the 
present invention; 

Figs. 2A and 2B, taken together, are simplified pictorial flow illustrations of a 
method of operation of the system of Fig. 1 in accordance with a preferred embodiment of the 
present invention; 

Fig. 3 is a simplified pictorial flow illustration of an anti-hacking method for use 
with the system of Fig. 1 operative in accordance with another preferred embodiment of the present 
invention; 

Fig. 4 is a simplified pictorial flow illustration of an anti-hacking method for use 
with the system of Fig. 1 operative in accordance with another preferred embodiment of the present 
invention; 

Fig. 5 is a simplified pictorial flow illustration of an anti-hacking method for use 
with the system of Fig. 1 in accordance with another preferred embodiment of the present 
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invention; 

Fig. 6 is a simplified pictorial flow illustration of a file protection method for use 
mth the system of Fig. 1 operative in accordance with another preferred embodiment of the present 
invention; and 

Fig. 7 is a simplified pictonal flow illustration of a file protection method for use 
with the system of Fig. 1 operative in accordance with another preferred embodiment of the present 



DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
Reference is now made to Fig. 1 which is a simplified block diagram of a system for 
preventing unauthorized copying of files, the system constructed and operative in accordance with a 
preferred embodiment of the present invention. In the system of Fig. 1 a server 10 is provided for 
communication with a client 12 via a communications network 14, such as the Internet or an 
Intranet. Server 10 is typically any known computer configured with web server software and 
communications software and hardware for communication via network 14 through a socket 16 as 
is well known. Examples of web server software include Internet Information Server™, 
commercially available from Microsoft Corporation, and Netscape HTTP Server™, commercially 
available from Netscape Corporation. Client 12 is typically any known computer configured with a 
web browser and communications software and hardware for communication via network 14 
through a socket 18 as is well known. Examples of web browser software include Internet 
Explorer™ version 3.02, commercially available from Microsoft Corporation, and Netscape 
Navigator™ version 2, commercially available from Netscape Corporation. 

Server 10 typically includes a storage 20 for storing files, such as HTML, GIF, JPEG, 
and other files, that server 10 may provide to requesting clients. Server 10 also typically includes a 
server configuration 22 which indicates to server 10 which client requests are to be forwarded to a 
filter 24 for processing. Filter 24 preferably refers to a protection map 26 in which a list of files on 
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storage 20 to be protected may be maintained. Filter 24 also typically ma.ntains an alias map 28 for 
mapping file aliases to real file names, as well as a cache 30 for storing processed files. Files 
processed by filter 24 may be sent to client 12 for additional processing by a protection module 32. 

A typical operational scenario of the system of Fig. 1 is now described with 
additional reference to simplified pictorial flow illustrations Figs. 2A and 2B, which are to be taken 
together. Operation begins with client 12 sending a request to server 10 for an HTML file. The 
request may be made using known means, such as by selecting a hyperlink to a World Wide Web 
page using a browser. Upon receiving the request from client 12, server 10 checks server 
configuration 22 to determine whether the requested file is of the type that is to be processed by 
filter 24 and, if it is, passes the request to filter 24. Filter 24 preferably checks protection map 26 to 
determine whether the requested file is protected or otherwise includes protected elements. For 
example, in the case of an HTML file, protection map 26 might indicate that the entire file is 
protected, and thus all files to which the file refers are to be protected. Similarly, protection map 
26 might indicate that an entire disk or directory is protected. Alternatively, protection map 26 
might indicate the names of specific files which are to be protected, or might simply indicate that 
the HTML file contains tags such as "<!protect>" and "<!/protect>" bounding a list of tags referring 
to files to be protected, such as "IMG" tags. If no level of protection is indicated, filter 24 may 
instruct server 10 to fulfil the request. 

Once filter 24 determines that some level of protection is required, filter 24 parses 
the HTML file and preferably replaces all tags that refer to a protected file with an appropriate 
substitute tag and related parameters needed to invoke the operation of protection module 32. Such 
tags may take the form of an "OBJECT" tag where protection module 32 is an ActiveX™ object for 
use with Internet Explorer™, or an "EMBED" tag where protection module 32 is a plug-in object 
for use with Internet Explorer™. Filter 24 also preferably substitutes a reference to the real file 
name of a protected file with a fictitious name that is preferably derivable from the real file name 
according to a predetermined algorithm in accordance with techniques well known in the art. Filter 
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24 preferably identifies the type of browser used from the client's request or otherwise in 
accordance with techniques well known in the art. Where an unsupported browser is detected, 
filter 24 may perform a contingency action such as replacing the tag with a link to an error message, 
replacing the file link with a link to an error message, or sending back the original tag with the real 
file name replaced with a fictitious file name in the same manner as described hereinbelow for 
protected files. Once the HTML file has been parsed and modified, filter 24 serves the modified 
file to client 12, typically by writing to socket 16 via which server 10 is currently communicating 
with client 12. 

Upon receiving the modified HTML file, client 12 invokes protection module 32 in 
accordance with the substituted "OBJECT" or "EMBED" tag. Protection module 32 then requests 
the protected file from server 10 using the fictitious file name. Once again server 10 checks server 
configuration 22 and determines that the request is to be forwarded to filter 24. Upon receiving the 
request filter 24 preferably derives the real file name from the fictitious file name using a 
predetermined algorithm as described above. Filter 24 then retrieves the file from storage 20 and 
preferably protects the file by encrypting, encoding, or otherwise modifying the file using a 
predetermined file protection algorithm, being any suitable algorithm known in the art for this 
purpose, preferably using an encryption key. Filter 24 may store the protected file in cache 30 for a 
period of time, allowing the file protection stage to be subsequently skipped and the protected file 
to be provided from cache 30 should the file be requested later. 

Filter 24 then serves the protected file to client 12 where protection module 32 
derives the original file using the same or a complementary file unprotection algorithm, and, where 
used, the same or a complementary encryption key being preconfigured with protection module 32, 
either hard-coded or derivable by protection module 32 using a key derivation algorithm, or 
otherwise sent to protection module 32 by filter 24. Protection module 32 then unprotects and 
displays, plays, presents, or otherwise outputs the original file using known techniques. 
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Protection module 32 preferably defeats file copying features at the operating system 
or application software level by disabling the Microsoft Windows™ "Print Screen," "Bitblt," 
"StretchBlt," or "GetPixel" functions. API calls such as "Bitblt," "StretchBlt," or "GetPixel" are 
preferably trapped and either prevented from copying and pasting the protected file or allowed to 
copy and paste a defaced, substituted, or otherwise modified file. "Print Screen" may similarly be 
disabled by trapping its API calls or by trapping the pressing of the "Print Screen" key and likewise 
defacing, substituting, or otherwise modifying the contents of the clipboard. Protection module 32 
may additionally or alternatively disable file saving features provided by browsers using known 
techniques. 

Reference is now made to Fig. 3 which is a simplified pictorial flow illustration of 
an anti-hacking method for use with the system of Fig. 1 in accordance with another preferred 
embodiment of the present invention. In the method of Fig. 3 protection module 32 periodically 
checks server 10 for updated components corresponding to components of protection module 32, 
such as DLL files. Upon detecting the existence of an updated component, protection module 32 
downloads the updated component for future use with files prepared in accordance with the method 
of Figs. 2A and 2B. In this manner an updated file preparation algorithm and/or key may be 
distributed to client 12 subsequent to a similar update of filter 24. 

Reference is now made to Fig. 4 which is a simplified pictorial flow illustration of 
an anti-hacking method for use with the system of Fig. 1 in accordance with another preferred 
embodiment of the present invention. In the method of Fig. 4 protection module 32 includes a 
hashing algorithm which may be used to hash software components of protection module 32 in 
order to derive a hash value. This hash value is preferably known in advance to filter 24 and may 
be appended or otherwise incorporated into the encyption key, either as is or after applying a 
modification algorithm to it, and used to prepare the file sent to client 12. Protection module 32 
may similarly incorporate the hash value into the encryption key for deriving the original file. As in 
Fig. 3, protection module 32 may periodically check server 10 for and download an updated 
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hashing algorithm. 

Reference is now made to Fig. 5 which is a simplified pictorial flow illustration of 
an anti-hacking method for use with the system of Fig. 1 in accordance with another preferred 
embodiment of the present invention. In the method of Fig. 5 protection module 32 includes a 
"blacklist" of known software applications known to have features which defeat anti-copying 
measures taken by protection module 32. Upon detecting that such a blacklisted application is 
currently running, either by the application's name or by detecting a known footprint for the 
application, protection module 32 may withhold requesting a protected file, may prevent a 
protected file from being displayed, played, presented, or otherwise output, and/or may mar the 
presentation of the file, and may provide a message to the user requiring that the blacklisted 
application be terminated before the protected file may be presented properly. 

Reference is now made to Fig. 6 which is a simplified pictorial flow illustration of a 
file protection method for use with the system of Fig. I in accordance with another preferred 
embodiment of the present invention. In the method of Fig. 6 client 12 sends a CGI request to 
server 10. Upon receiving the request from client 12, server 10 checks server configuration 22 to 
determine whether the request is of the type that is to be processed by filter 24 and, if it is, passes 
the request to filter 24. Filter 24 preferably appends a randomly-generated identifier to the CGI 
request and sends it back to server 10. Server 10 again checks server configuration 22, determines 
that the request is of the type that is to be processed by filter 24, and passes the CGI request back to 
filter 24. Filter 24 strips out the randomly-generated identifier and sends the CGI request to a CGI 
program 34 (Fig. 1) for processing. The CGI program then sends the results to server 10 which 
forwards the results to filter 24. Filter 24 preferably processes any files or HTML files received 
from the CGI program as described hereinabove with reference to Figs. 2A and 2B, protecting files 
as required, and serves the processed files to client 12. 

Reference is now made to Fig. 7 which is a simplified pictorial flow illustration of a 
file protection method for use with the system of Fig. 1 in accordance with another preferred 
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embodiment of the present invention. In the method of Fig. 7 client 12 sends a request for a file, 
such as an HTML file, to server 10. Upon receiving the request from client 12, server 10 checks 
server configuration 22 to determine whether the request is of the type that is to be processed by 
filter 24 and, if it is, passes the request to filter 24. Filter 24 then checks alias map 28 to determine 
if the requested file is actually an alias to be substituted with an HTTP request to server 10 or 
another server, the identity of which server is maintained in alias map 28 along with the alias file 
name. If alias map 28 indicates that the file is an alias, filter 24 then issues the subtitiute HTTP 
request to the server and address indicated in alias map 28. Upon receiving the requested HTML or 
file, filter 24 then preferably processes the file as described hereinabove with reference to Figs. 2A 
and 2B, protecting files as required, and serves the processed files to client 12. 

It is appreciated that components of the present invention may be implemented in 
computer hardware, software, or any suitable combination thereof using conventional techniques. 

It is appreciated that the steps of the methods described hereinabove need not 
necessarily be performed in the order shown, and that in fact different implementations of the steps 
may be employed to yield similar overall results. 

It will be appreciated by persons skilled in the art that the present invention is not 
limited by what has been particularly shown and described hereinabove. Rather the scope of the 
present invention includes both combinations and subcombinations of the features described 
hereinabove as well as modifications and variations thereof which would occur to a person of skill 
in the art upon reading the foregoing description and which are not in the prior art. 
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CLAIMS 

We claim: 

1 . A method for preventing unauthorized copying of files sent from a first computer to 

a second computer, the method comprising: 

(a) sending a request for a file from said second computer to said first computer; 

(b) determining at said first computer, in response to said request, whether said 
file is to be protected and, if so, protecting said file; 

(c) sending said protected file to said second computer; 

(d) disabling file copying capabilities at said second computer; 

(e) unprotecting said file at said second computer; and 

(f) outputting said file at said second computer. 

2 " A method according to claim 1 wherein any of said sending steps comprises sending 

via a network. 

3 - A method according to claim 1 wherein said first computer is a server and said 

second computer is a client. 



4 - A method according to claim 1 wherein said determining step (b) comprises 
protecting said file by encrypting said file using an encryption key and wherein said unprotecting 
step (e) comprises decrypting said encrypted file using said encryption key. 

5 - A method according to claim 1 wherein said second computer is configured with a 
MICROSOFT WINDOWS operating system and wherein said disabling step (d) comprises trapping 
any of print screen, bitblt, stretchblt, and getpixel function calls and, in response to said trapping, 
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replacing contents of a clipboard associated with said operating system with substitute contents. 

6. A method according to claim 1 wherein said second computer is configured with a 

MICROSOFT WINDOWS operating system and wherein said disabling step (d) comprises trapping 
any of print screen, bitblt, stretchblt, and getpixel function calls and, in response to said trapping, 
marring contents of a clipboard associated with said operating system. 

7 - A m et hod according to claim 1 wherein said outputting step (f) comprises displaying 

said file on a computer monitor. 

8 A method according to claim 1 wherein said outputting step (f) comprises outputting 

said file as sound. 



9 - A method according to claim 1 and further comprising: 

(g) maintaining at said first computer a list of files to be protected, and wherein 
said determining step (b) comprises determining whether said file requested in step (a) is in said list 
of files. 



10 - A method according to claim 1 and further comprising: 

prior to said sending a request step (a): 

(h) sending a request for an HTML file from said second computer to 

said first computer; 

(i) determining at said first computer, in response to said request, 
whether said HTML file comprises an instruction to retrieve a file to be protected; 

0') modifying said HTML file by replacing said instruction with an 
instruction to invoke a protection module for use in retrieving said file to be protected; and 
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(k) sending said modified HTML file to said second computer. 

^ 1 L ' A method according to claim 10 wherein said modifying said HTML file step (h) 

comprises replacing the name of said file to be protected with a substitute file name. 

12. A method according to claim 11 wherein said modifying said HTML file step (h) 
comprises deriving said substitute file name from said name of said file to be protected using a 
predetermined file name derivation algorithm. 

13. A method according to claim 1 1 and further comprising: 

(1) maintaining at said first computer a mapping of names of files to be 
protected to corresponding substitute file names, and wherein said determining step (b) comprises 
determining whether the name of said file requested in step (a) is a substitute file name in said 
mapping and, if so, protecting said file to be protected corresponding to said substitute file name. 

14. A method according to claim 10 and further comprising configuring said second 
computer with said protection module. 

15. A method according to claim 14 wherein said protection module periodically checks 
a third computer for an updated component of said protection module and, if found, downloads said 
updated component. 

16. A method according to claim 1 wherein said determining step (b) comprises 
protecting said file by encrypting said file using an encryption key together with a predetermined 
hash value incorporated therein, and further comprising configuring said second computer with a 
protection module operative to hash a software component of said protection module, thereby 
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deriving said predetermined hash value, and incorporate said hash value into said encyption key, 
and wherein said unprotecting step (e) composes decrypting said encrypted file using said 
encryption key together with said derived hash value. 

17. A method according to claim 1 and further comprising: 

configuring said second computer with a blacklist of known software applications, 
and wherein said outputting step (f) comprises outputting only if none of said blacklisted 
applications are currently running on said second computer. 



A method for serving a CGI request by proxy, the method comprising: 

sending a CGI request from a client to a server; 

forwarding said CGI request from said server to a filter; 

appending at said filter an identifier to the CGI request; 

sending said CGI request with identifier from said filter to said server; 

forwarding said CGI request with identifier from said server to a filter; 

removing at said filter said identifier from said CGI request; 

sending said CGI request from said filter to a CGI program; 

processing said CGI request at said CGI program; 

receiving at said server results from said CGI program, 

sending said results from said server to said filter; 

processing said results at said filter; and 

sending said processed results to said client. 

A method for serving an aliased HTTP request, the method comprising: 
sending a request for a file from a client to a first server; 
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issuing a subst.tute HTTP request corresponding to said requested file to a second 



receiving at said first server results of said substitute HTTP request; 

processing said results at said first server; and 

sending said processed results to said client. 
20. A method substantially as shown and described above. 

2 1 ■ A method substantially as illustrated in any of the drawings. 

For the Applicant, 



Sanford T. Colb & Co. 
C33096 
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FIELD OF THE INVENTION 
The present invention relates to network security in general and particularly to 
methods and apparatus for preventing unauthorized copying of images transmitted via computer 
networks. 

BACKGROUND OF THE INVENTION 
Preventing unauthorized copying of images transmitted via computer networks is 
difficult given the current state of the art. Typically, a computer terminal or "client" connected to a 
network, such as the Internet, sends a request using software known as a "browser" to a "server" 
also connected to the network. Such requests are often for "Web pages," documents constructed 
using Hypertext Markup Language or HTML, and their associated images which are then sent by 
the server and rendered by the client browser for viewing. Images are typically received at the 
client in a standard format such as GIF or JPEG, are automatically stored at the client, and may be 
easily copied and pasted, allowing for unrestricted future reuse, often in violation of copyright laws. 



SUMMARY OF THE INVENTION 

The present invention seeks to provide improved methods and apparatus for 
preventing unauthorized copying of images transmitted via computer networks that overcome the 
known disadvantages of the prior art as discussed above.. 

There is thus provided in accordance with a preferred embodiment of the present 
invention a method for preventing unauthorized copying of images, the method including protecting 
an image file on a first computer using a protection algorithm, providing the protected image to a 
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second computer, disabling image copying functions on the second computer, and unprotecting the 

protected image on the second computer for display using an unprotection algorithm. 

Further in accordance with a preferred embodiment of the present invention the 
^protecting step includes protecting using an encryption key. 

Still further in accordance with a preferred embodiment of the present invention the 
encryption key includes a hash value component. 

Additionally in accordance with a preferred embodiment of the present invention the 
method further includes modifying an HTML file that includes at least one link to the protected 
image by substituting IMG tags of protected images with calls to image unprotection software on 
the second computer. 

Further in accordance with a preferred embodiment of the present invention the 
modifying step includes replacing file names of the protected images with derived file names using 
a file name derivation algorithm. 

It is noted that throughout the specification and claims the term "user" as it is used 
with respect to the use of a computer may refer to a human or surrogate therefor in combination 
with the computer interface with which the human or surrogate interacts. Thus, unless otherwise 
specified, a reference to a user may connote a reference to the user's computer interface, and a 
reference to a user's computer interface may connote a reference to the user. 

BRIEF DESCRIPTION OF THE DRAWINGS 

The present invention will be understood and appreciated more fully from the 
following detailed description, taken in conjunction with the drawings in which; 

Fig. 1 is a simplified block diagram of a system for preventing unauthorized copying 
of images, the system constructed and operative in accordance with a preferred embodiment of the 
present invention; 
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.. ^_ . taken together, are simplified pictorial flow illustrations of a 

rnethod of operation of the system of Fig. 1 in accordance with a preferred embodiment of the 

present invention; 

^ Fig. 3 is a simplified pictorial flow illustration of an anti-hacking method for use 

with the system of Fig. 1 operative in accordance with another preferred embodiment of the present 
invention; 

Fig. 4 is a simplified pictorial flow illustration of an anti-hacking method for use 
with the system of Fig. 1 operative in accordance with another preferred embodiment of the present 
invention; 

Fig. 5 is a simplified pictorial flow illustration of an anti-hacking method for use 
with the system of Fig. 1 in accordance with another preferred embodiment of the present 
invention; 

Fig. 6 is a simplified pictorial flow illustration of an image protection method for use 
with the system of Fig. 1 operative in accordance with another preferred embodiment of the present 
invention; and 

Fig. 7 is a simplified pictorial flow illustration of an image protection method for use 
with the system of Fig. 1 operative in accordance with another preferred embodiment of the present 
invention. 

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
Reference is now made to Fig. 1 which is a simplified block diagram of a system for 
preventing unauthorized copying of images, the system constructed and operative in accordance 
with a preferred embodiment of the present invention. In the system of Fig. 1 a server 1 0 is 
provided for communication with a client 12 via a communications network 14, such as the Internet 
or an Intranet. Server 10 is typically any known computer configured with web server software and 
communications software and hardware for communication via network 14 through a socket 16 as 
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is well known. Examples of web server software include Internet Information Server™, 



available from Netscape Corporation. Client 12 is typically any known computer configured with a 
web browser and communications software and hardware for communication via network 14 
through a socket 18 as is well known. Examples of web browser software include Internet 
Explorer™ version 3.02, commercially available from Microsoft Corporation, and Netscape 
Navigator™ version 2, commercially available from Netscape Corporation. 



and other files, that server 10 may provide to requesting clients. Server 10 also typically includes a 
server configuration 22 which indicates to server 10 which client requests are to be forwarded to a 
filter 24 for processing. Filter 24 preferably refers to a protection map 26 in which a list of files on 
storage 20 to be protected may be maintained. Filter 24 also typically maintains an alias map 28 for 
mapping file aliases to real file names, as well as a cache 30 for storing processed image files. Files 
processed by filter 24 may be sent to client 12 for additional processing by an image client 32. 



additional reference to simplified pictorial flow illustrations Figs. 2A and 2B, which are to be taken 
together. Operation begins with client 12 sending a request to server 10 for an FfTML file. The 
request may be made using known means, such as by selecting a hyperlink to a World Wide Web 
page using a browser. Upon receiving the request from client 12, server 10 checks server 
configuration 22 to determine whether the requested file is of the type that is to be processed by 
filter 24 and, if it is, passes the request to filter 24. Filter 24 preferably checks protection map 26 to 
determine whether the requested file is protected or otherwise includes protected elements. For 
example, in the case of an HTML file, protection map 26 might indicate that the entire file is 
protected, and thus all images to which the file refers are to be protected. Similarly, protection map 
26 might indicate that an entire disk or directory is protected. Alternatively, protection map 26 
migfij indicate the names of specific image files which are to be protected, or might simply indicate 



commercially available from Microsoft Corporation, and Netscape HTTP Server™, commercially 




Server 10 typically includes a storage 20 for storing files, such as HTML, GIF, JPEG, 



A typical operational scenario of the system of Fig. 1 is now described with 



4 



0 EXHIBIT B ^ 

that the HTML file contains tags such as "<!protect>" and "<!/protect>" bounding a list of "IMG" 

tags with images to be protected. If no level of protection is indicated, filter 24 may instruct server 
10 to fulfil the request. 

^ Once filter 24 determines that some level of protection is required, filter 24 parses 

the HTML file and preferably replaces all "IMG" tags associated with a protected image with an 
appropriate substitute tag and related parameters needed to invoke the operation of image client 32. 
Such tags may take the form of an "OBJECT" tag where image client 32 is an ActiveX™ object for 
use with Internet Explorer™, or an "EMBED" tag where image client 32 is a plug-in object for use 
with Internet Explorer™. Filter 24 also preferably substitutes a reference to the real file name of a 
protected image with a fictitious name that is preferably derivable from the real file name according 
to a predetermined algorithm in accordance with techniques well known in the art. Filter 24 
preferably identifies the type of browser used from the client's request or otherwise in accordance 
with techniques well known in the art. Where an unsupported browser is detected, filter 24 may 
perform a contingency action such as replacing the "IMG" tag with a link to an error message, 
replacing the image link with a link to an error message image, or sending back the original "IMG" 
tag with the real image file name replaced with a fictitious image file name in the same manner as 
described hereinbelow for protected images. Once the HTML file has been parsed and modified, 
filter 24 serves the modified file to client 12, typically by writing to socket 16 via which server 10 is 
currently communicating with client 12. 

Upon receiving the modified HTML file, client 12 invokes image client 32 in 
accordance with the substituted "OBJECT" or "EMBED" tag. Image client 32 then requests the 
protected image from server 10 using the fictitious image file name. Once again server 10 checks 
server configuration 22 and determines that the request is to be forwarded to filter 24. Upon 
receiving the request filter 24 preferably derives the real image file name from the fictitious image 
file name using a predetermined algorithm as described above. Filter 24 then retrieves the image 
fi ]e frpm Stprage 20 and preferably protects the image by encrypting, encoding, or otherwise 
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modifying the image file using a predetermined image protection algorithm, being any suitable 

algorithm known in the art for this purpose/preferably using an encryption key. Filter 24 may store 
the protected image in cache 30 for a period of time, allowing the image file protectionstage to be 
^subsequently skipped and the protected image file to be provided from cache 30 should the image 
be requested later. 

Filter 24 then serves the protected image to client 12 where image client 32 derives 
the original image using the same or a complementary image unprotection algorithm, and, where 
used, the same or a complementary encryption key being preconfigured with image client 32, either 
hard-coded or derivable by image client 32 using a key derivation algorithm, or otherwise sent to 
image client 32 by filter 24. Image client 32 then unprotects and displays the original image using 
known techniques. 

Image client 32 preferably defeats image copying features at the operating system or 
application software level by disabling the Microsoft Windows™ "Print Screen," "Bitblt," 
"StretchBlt," or "GetPixel" functions. API calls such as "Bitblt," "StretchBlt," or "GetPixel" are 
preferably trapped and either prevented from copying and pasting the protected image or allowed to 
copy and paste a defaced, substituted, or otherwise modified image. "Print Screen" may similarly 
be disabled by trapping its API calls or by trapping the pressing of the "Print Screen" key and 
likewise defacing, substituting, or otherwise modifying the contents of the clipboard. Image client 
32 may additionally or alternatively disable image saving features provided by browsers using 
known techniques. 

Reference is now made to Fig. 3 which is a simplified pictorial flow illustration of 
an anti-hacking method for use with the system of Fig. 1 in accordance with another preferred 
embodiment of the present invention. In the method of Fig. 3 image client 32 periodically checks 
server 10 for updated components corresponding to components of image client 32, such as DLL 
files. Upon detecting the existence of an updated component, image client 32 downloads the 
upd^d component for future use with images prepared in accordance with the method of Figs. 2A 
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ed image preparation algorithm and/or key may be distributed to 

client 12 subsequent to a similar update of filter 24. 

Reference is now made to Fig. 4 which is a simplified pictorial flow illustration of 
an anti-hacking method for use with the system of Fig. 1 in accordance with another preferred 
embodiment of the present invention. In the method of Fig. 4 image client 32 includes a hashing 
algorithm which may be used to hash software components of image client 32 in order to derive a 
hash value. This hash value is preferably known in advance to filter 24 and may be appended or 
otherwise incorporated into the encyption key, either as is or after applying a modification 
algorithm to it, and used to prepare the image file sent to client 12. Image client 32 may similarly 
incorporate the hash value into the encryption key for deriving the original image. As in Fig. 3, 
image client 32 may periodically check server 10 for and download an updated hashing algorithm. 

Reference is now made to Fig. 5 which is a simplified pictorial flow illustration of 
an anti-hacking method for use with the system of Fig. 1 in accordance with another preferred 
embodiment of the present invention. In the method of Fig. 5 image client 32 includes a "blacklist" 
of known software applications known to have features which defeat anti-copying measures taken 
by image client 32. Upon detecting that such a blacklisted application is currently running, either 
by the application's name or by detecting a known footprint for the application, image client 32 
may withhold requesting a protected image, may prevent a protected from being displayed, and/or 
may mutilate the displayed image, and may provide a message to the user requiring that the 
blacklisted application be terminated before the protected image may be viewed properly. 

Reference is now made to Fig. 6 which is a simplified pictorial flow illustration of 
an image protection method for use with the system of Fig. 1 in accordance with another preferred 
embodiment of the present invention. In the method of Fig. 6 client 12 sends a CGI request to 
server 10. Upon receiving the_request from client 12, server 10 checks server configuration 22 to 
determine whether the request is of the type that is to be processed by filter 24 and, if it is, passes 
the request to filter 24. Filter 24 preferably appends a randomly-generated identifier to the CGI 
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request and sends it back to server 10. Server 10 again checks server configuration 22, determines 

that the request is of the type that is to be processed by filter 24, and passes the CGI request back to 
filter 24. Filter 24 strips out the randomly-generated identifier and sends the CGI request to a CGI 
program 34 (Fig. 1) for processing. The CGI program then sends the results to server 10 which 
forwards the results to filter 24. Filter 24 preferably processes any image files or HTML files 
received from the CGI program as described hereinabove with reference to Figs. 2A and 2B, 
protecting image files as required, and serves the processed files to client 12. 

Reference is now made to Fig. 7 which is a simplified pictorial flow illustration of 
an image protection method for use with the system of Fig. 1 in accordance with another preferred 
embodiment of the present invention. In the method of Fig. 7 client 12 sends a request for a file, 
such as an HTML file, to server 10. Upon receiving the request from client 12, server 10 checks 
server configuration 22 to determine whether the request is of the type that is to be processed by 
filter 24 and, if it is, passes the request to filter 24. Filter 24 then checks alias map 28 to determine 
if the requested file is actually an alias to be substituted with an HTTP request to server 10 or 
another server, the identity of which server is maintained in alias map 28 along with the alias file 
name. If alias map 28 indicates that the file is an alias, filter 24 then issues the subtitiute HTTP 
request to the server and address indicated in alias map 28. Upon receiving the requested HTML or 
image file, filter 24 then preferably processes the file as described hereinabove with reference to 
Figs. 2A and 2B, protecting image files as required, and serves the processed files to client 12. 

It is appreciated that components of the present invention may be implemented in 
computer hardware, software, or any suitable combination thereof using conventional techniques. 

It is appreciated that the steps of the methods described hereinabove need not 
necessarily be performed in the order shown, and that in fact different implementations of the steps 
may be employed to yield similar overall results. 

It will be appreciated by persons skilled in the art that the present invention is not 
limited by what has been particularly shown and described hereinabove. Rather the scope of the 
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present invention includes both combinations and subcombinations of the features described 

hereinabove as well as modifications and variations thereof which would occur to a person of skill 
in the art upon reading the foregoing description and which are not in the prior art. 
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EXHIBIT B 

CLAIMS 




We claim: 



1. 



A method for preventing unauthorized copying of images, the method comprising: 




protecting an image file on a first computer using a protection algorithm; 



providing said protected image to a second computer; 



disabling image copying functions on said second computer; and 



unprotecting said protected image on said second computer for display using an 



unprotection algorithm. 

2 - A method according to claim 1 wherein said protecting step comprises protecting 
using an encryption key. 

3 - A method according to claim 2 wherein said encryption key comprises a hash value 
component. 

4 - A method according to claim 1 and further comprising modifying an HTML file that 
comprises at least one link to said protected image by substituting IMG tags of protected images 
with calls to image unprotection software on said second computer. 

5 - A method according to claim 4 wherein said modifying step comprises replacing file 
names of said protected images with derived file names using a file name derivation algorithm. 

6- A method substantially as shown and described above. 



7. 



A method substantially as illustrated in any of the drawings. 




Sanford T. Colb & Co. 
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